Splunk SPLK-3001 問題集

質問 1：
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?
A. ess_analyst
B. ess_reviewer
C. ess_user
D. ess_admin
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?
A. If indexed realtime search is enabled, disable it for the notable index.
B. Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.
C. Change the search heads to do local indexing of summary searches.
D. Increase memory and CPUs on the search head(s) and add additional indexers.
正解：D

質問 3：
Which of the following actions would not reduce the number of false positives from a correlation search?
A. Increasing the throttling window.
B. Increasing threshold sensitivity.
C. Reducing the severity.
D. Removing throttling fields.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?
A. A suffix of .spl
B. A prefix of TECH_
C. A prefix of CIM_
D. A prefix of Splunk_TA_
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
The option to create a Short ID for a notable event is located where?
A. The Description.
B. The Contributing Events.
C. The Additional Fields.
D. The Event Details.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Which of the following threat intelligence types can ES download? (Choose all that apply)
A. Splunk Enterprise Threat Generator
B. Text
C. STIX/TAXII
D. VulnScanSPL
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
An administrator wants to ensure that none of the ES indexed data could be compromised through tampering.
What feature would satisfy this requirement?
A. Index access permissions.
B. Indexer acknowledgement.
C. Index consistency.
D. Data integrity control.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 8：
ES needs to be installed on a search head with which of the following options?
A. Only default built-in and CIM-compliant apps.
B. No other apps.
C. All apps removed except for TA-*.
D. Any other apps installed.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 9：
How should an administrator add a new look up through the ES app?
A. Upload the lookup file in Settings -> Lookups -> Lookup table files
B. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup
C. Upload the lookup file in Settings -> Lookups -> Lookup Definitions
D. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
正解：B
解説: (Topexam メンバーにのみ表示されます)